Apple's Exposure Notification System: Everything You Need to Know

Apple launched an Exposure Warning System in May 2020 that helps public health agencies and governments around the world to help individuals find out whether they have been exposed to COVID-19 and, if so, what steps to take to reduce the spread of the virus next.

Exposure Notification Explained

Exposure notification began as contact tracing, an initiative by Apple-Google that was announced in early April to restrict the spread of COVID-19.

Apple and Google have built an API that enables iPhones and Android smartphones to communicate with each other for communication monitoring purposes, so if and when someone who is later diagnosed with COVID-19 happens to be nearby, you will get a warning and take the appropriate measures to isolate yourself and, if possible, get medical assistance.

Whenever you are around someone else who also owns a smartphone, sharing anonymous identifiers, deciding if you have come into touch with someone depends on your iPhone, which, using the exposure notification API, communicates with other iPhones and Android smartphones over Bluetooth.

The underlying APIs and Bluetooth features have been developed by Apple and Google, but the apps that use those APIs are not being developed. Instead, the software is incorporated into applications developed by public health authorities worldwide, which can use the tracking information to send exposure notifications and follow-up with suggested next steps. "An" Express "feature has also been introduced by Apple and Google, allowing Exposure Alerts to function in collaboration with health authorities,but without an Exposure Notification app.

The APIs have been created with privacy and security in mind, and app usage is opt in rather than mandatory.

How Exposure Notification Works

Nearly everybody has a smartphone, making them perfect for deciding with whom you've come in touch. Exposure notification has a self-explanatory name, and in a nutshell, if you have been near a person diagnosed with COVID-19, the feature is designed to give you a notification.

Here's a detailed, step-by-step walkthrough on how it works:
1. Two individuals, Ryan and Eric, are both shopping for food on a Tuesday afternoon at the same grocery store. Eric has an iPhone and Ryan has an Android phone that uses the exposure monitoring API or the Express Exposure Notification feature, all with a health app.
2.There's a long wait, so Eric and Ryan are together for about 10 minutes in the checkout line. Each of their phones transmits absolutely anonymous identifier beacons during this period, and picks up the identifier beacons transmitted by the other individual. Their phones know they've been in touch with the computer itself and store the information, transmitting it nowhere else.
3. Ryan comes down with the symptoms of COVID-19 a week later, sees a doctor, and is diagnosed with COVID-19. He opens his Android phone, uses paperwork from a healthcare provider to check his diagnosis, and taps a button that uploads his identifier beacon to a centralised cloud server.
4. Eric's iPhone downloads a list of all the new beacons from individuals that have contracted COVID-19 later that day. Eric then gets a note that because of his encounter with Ryan at the grocery store, he was in touch with someone who has COVID-19.
5. Eric does not know that it was Ryan who had COVID-19 because no personally identifiable information was gathered, but the device knows that Eric was exposed to COVID-19 on Tuesday for 10 minutes, and that he stood near to the person who exposed him between their two phones based on the strength of the Bluetooth signal, enabling the app to provide the necessary information.
6. Eric is following his local public health authority's steps on what to do after exposure to COVID-19.
7.If Eric comes down with COVID-19 later, he takes the same measures mentioned above to warn individuals with whom he has been in contact, helping everyone to track possible exposure better.

Apple and Google also created a handy graphic that explains the process, which we've included below:

What You Need to Do to Use Exposure Notification

To use Exposure Notifications on a computer running the latest iOS update, you need to open the Settings app, select the "Exposure Notifications" portion, and then tap "Turn on Exposure Notifications."

From here, your iPhone will let you know if an Exposure Notification app is available, providing information on how to download it in your state , country, or area. You will also be notified if you can use Exposure Notifications via the Express feature without an app, or if Exposure Notifications are currently unavailable in your region.

Exposure Warning is a default feature that is disabled, and actually using the API allows you to turn on the feature and download an app from a confirmed health authority in some situations. Most nations are developing countries and state-specific applications that can be accessed by users.

The Exposure Notification API on the iPhone does nothing without explicitly opting-in to use the Exposure Notifications feature. The Exposure Notification feature will become active on your smartphone once you have downloaded an app and consented to use it, or consented to use the Express option.

Cross-Platform App Communication

Both Apple and Google have collaborated to develop exposure notification APIs that function together so that iPhone and Android smartphones can communicate with each other and you can receive alerts if exposure occurs, even if there is an Android smartphone for the person you have been in touch with.

Exposure Notification Opt-In

Notifications of exposure on the iPhone are turned off by default and must be enabled. Using the function allows users to agree to sign up for the notification system for exposure, which is part of the process of signing up. You may trigger Exposure Alerts by using the 'Exposure Notifications' section of the Settings app.

If you do get COVID-19 at some point, there is a different consent mechanism to anonymously warn people with whom you have been in contact. The role requires express permission to notify others of the diagnosis, and nothing happens automatically.

Disabling Exposure Notification

You can fully disable Exposure Notifications by opening the Settings app and pressing 'Turn Exposure Notifications off.' If you have downloaded an Exposure Notification app, you can also uninstall the Exposure Notifications disabled app. Since Exposure Alerts is disabled by default, you don't need to do anything to disable it if you've never used it.

Exposure Notification Verification

When an individual is diagnosed with COVID-19, the apps that use Apple and Google 's exposure notification APIs need proof that a person has tested positive for the disease before a warning is sent out to the people with whom they have been in touch.

This prevents individuals from maliciously using the method to trick others into thinking that disclosure has occurred when it has not.

As an example , a person who tests positive for COVID-19 can receive a QR code with their test results, which for verification purposes can be scanned into an exposure notification app. According to Apple, the verification process varies by region.

How Exposure Notifications Work

As mentioned above, with a health app that uses the exposure notification API installed or the Express framework enabled with express consent, your smartphone shares anonymous identifiers with each person you come in touch with that also has an app that uses the API.

A list of these identifiers is stored on your phone, and this list remains on your system — it is not uploaded elsewhere. The exception is if you are diagnosed with COVID-19 and then take the measures to send updates to your smartphones.

The list of random identifiers that your iPhone has been allocated over the previous 14 days is submitted to a centralised server in this situation. The iPhones of other individuals search this server and download the list, comparing it against the identifiers stored on their own iPhones. If there's a match, they get an exposure update with more detail about the next steps to take.

Matches are made on the computer rather than on a central location server, which protects privacy while also ensuring that individuals are aware of potential exposure.

For a more simple explanation, here's a step-by-step walkthrough on how it works:

1.The grocery store is where Ryan and Eric interact. Ryan's Android phone has a random identifier number, 12486, which is unique to Ryan's phone during this interaction (and which changes every 15 minutes).
2.Eric's iPhone records the random identification number of Ryan, 12486, and gives Ryan a random identifier of his own, 34875. At the grocery store, both Ryan and Eric are in communication with a dozen individuals, so their smartphones import random identifiers from all of these phones.
3. Ryan contracts COVID-19, confirms his diagnosis in the app, and consents to upload to a central server accessible through Eric's COVID-19 app all of the identifiers his phone has used for the last two weeks (including 12486). At this point, Ryan's identifier is shared with a central database, but no personal information is associated with these random identifier numbers and does not include location details.
4. Eric's phone downloads the list of identifiers of individuals diagnosed with COVID-19, which includes the identifier of Ryan, 12486, and compares it to the list of identifiers stored on the basis of Eric's experiences.
5. A match is made, so Eric is told that he has been in touch with someone who has COVID-19 and that he receives details about the next steps to take.

As measured by the Bluetooth signal power, which can be used to measure the gap, public health authorities may have access to information that includes the amount of time Eric and Ryan's phones have been in touch and the distance between them.

The Exposure Alerts System will provide location-specific, personalised notifications to Eric based on this information, maybe letting him know his level of exposure and possible danger based on those factors. The device would know the day he was exposed, how long the exposure lasted, and the frequency of that contact's Bluetooth signal. There is no exchange of any other personal information.

In their definitions of an exposure event, each public health authority is able to determine what constitutes an exposure event and the amount of exposure events a person has had, plus it helps apps to consider the risk of transmission of positive cases, all of which can influence how and when exposed users are contacted.

App Demonstrations

To give users an idea of what to expect before making a download, Apple and Google gave examples of how apps would function. There is a new menu in iOS 13.5 under Settings > Health > COVID-19 Exposure Logging that lets users know which app they are using by the public health authority, along with a list of exposure tests that can be removed.

The app will have a push notification letting them know about the incident when a user is potentially exposed to COVID-19. In the app, all exposure events for the last 14 days are identified, and specifics include whether a diagnosis has been confirmed and when you were near the individual who became ill later.

When Data is Shared

The exposure warning system runs on your computer, for the most part. On your mobile, identifiers are entirely obtained and matched and are not exchanged with a central system. Two exceptions to this are:

1. The most recent identifier beacons (from the last 14 days) are added to the positive diagnosis list shared by a public health authority when a user is diagnosed with COVID-19 and chooses to report that positive diagnosis to the contact tracing system to allow others who have come into contact with that identifier to be alerted.
2.The day the contact occurred, how long it lasted, and the Bluetooth signal intensity of that contact is exchanged when a user is alerted via their smartphone that they have come into contact with a person who has tested positive for COVID-19.

Exposure Notification Privacy Details

First and foremost, complete privacy information on exposure notification is available on Apple's website, but below we will address some essential privacy questions that are commonly asked.

*No Data Identification-Your name, Apple ID and other information will never be exchanged with or connected with apps that use the API to monitor exposure.
*No location data-No location data is obtained, used, or exchanged by the device. Notification of exposure is not for monitoring where people are, but for deciding if another individual has been around a person.
*Random identifiers-Your iPhone is given a random, rotating identifier (a number string) that is transmitted to other nearby devices using Bluetooth. Every 10 to 20 minutes, identifiers change.
* On-site operation-Identifiers that come into contact with your phone or phones that come into contact with your ID are stored on your device and are not uploaded without permission anywhere.
*Consent-based sharing-If you test positive for COVID-19, without express permission, the people you were in touch do not receive an warning.
*On-device identifier matching-If you contract COVID-19 and consent to share that information, your identifier list from the last two weeks is uploaded to a central server that other devices can check to identify a match on their iPhones.
*Opt-in-The notice of exposure is completely opt-in. You do not need to use the function because, unless you download an app that uses the API, it does not work. It also doesn't work if the Exposure Alerts option in the Settings app is switched off.
*Sharing data with Apple / Google-Apple and Google do not obtain user identity information, location data, or any other device near the user.
*Data monetization-the exposure notification project will not be monetized by Apple and Google.
*Verified health apps only-Only public health agencies across the globe can use Apple's APIs. In terms of privacy, protection, and data control, apps must meet clear requirements. Apps may access a list of user-confirmed positive beacons given by COVID-19 users who have chosen to share them, but no personally identifying information is included.
* Disabling exposure notification-Apple and Google can, on a regional basis, disable the exposure notification system when it is no longer required.

Restrictions for Apps

To use the Exposure Notification API, apps need to meet a number of restrictions to be accepted. In order to ensure that there is no fragmentation and to encourage high user adoption, only one app per country is permitted.

The exception is if a nation has chosen a regional or state strategy, which is endorsed by Apple and Google. It is also important to meet the following restrictions:

Apps must be created by or for a government public health authority and they can only be used for COVID-19 response efforts.
Apps must require users to consent before the app can use the API.
Apps must require users to consent before sharing a positive test result with the public health authority.
Apps should only collect the minimum amount of data necessary and can only use that data for COVID-19 response efforts. All other uses of user data, including targeting advertising, is not permitted.
Apps are prohibited from seeking permission to access Location Services.

Apps That Use the Exposure Notification API

To date, all apps using the Apple Exposure Notification API have been released in Switzerland, Latvia, Italy , Germany, Poland, Saudi Arabia, Ireland, Croatia, Denmark , the Netherlands, Scotland, Canada , Japan, England, Wales and Belgium.

In the United States, applications using Apple's Exposure Notification API have been released in Virginia, North Dakota, Arizona, Delaware, Nevada, Alabama, Wyoming, North Carolina, Pennsylvania, Michigan, New York , and New Jersey.

Users of the iPhone may have more than one installed Exposure Notification app, but only one can be active at a time. In Privacy > Health > COVID-19 Exposure Logging, you can find options to control which app is functional.

Exposure Notifications Express

Exposure Notifications Express, introduced as part of iOS 13.7, is the second-generation version of the Exposure Notification API at the operating system level, enabling states, nations, and regions to take advantage of the Exposure Notification System without having to create an entire app.

Exposure Alerts Express can be interpreted without an app as Exposure Notifications, but using the feature also needs supervision in a given region by a public health authority.

Instead, public health agencies who wish to use Exposure Alerts Express should provide information to Apple and Google about how to contact the public health authority, resident guidance, and recommendations on future actions.

Apple and Google use this information to offer an Exposure Notification System to customers on behalf of the Public Health Authority. Public health authorities provide the name, logo, criteria for triggering an exposure notification and the materials to be presented to users in the event of exposure.

Maryland, Virginia, Nevada, and Washington , D.C. The first areas to use the Exposure Notifications Express will be the first.

Exposure Alerts Express programmes are interoperable with each other from different areas and with existing Exposure Notifications applications that have been rolled out. Instead of using Exposure Alerts Express, public health agencies may also choose to create their own custom software.

With the latest features, privacy continues to be a priority. "While an app is not inherently necessary in an area where Exposure Notifications Express has been selected by a public health authority, it still needs to be explicitly activated on an iPhone by opening the settings, navigating to the Exposure Notification section, and tapping" Turn on Exposure Notifications. "It is possible to opt out at any time.

Health Organization Partners

A number of health authorities have established the API, including the CDC, the Association of Public Health Laboratories, the Association of State and Territorial Health Officials, the Council of State and Territorial Epidemiologists, and the Taskforce for Global Health's Public Health Informatics Institute.

More Information

Apple and Google also have dedicated pages with more detail about notification of exposure, and if you want to know more about it and how it functions, that should be your first stop.

Search This Blog

Tech Articles